Skip to main content

Public advisory of scammers impersonating CSA and the SPF

Stay vigilant. Read the public advisory

Cyber Security Agency of Singapore
  1. Home
  2. Alerts & Advisories
  3. Alerts
  4. Multiple High Severity Vulnerabilities in Cisco IOS and IOS XE Software
Alerts

Multiple High Severity Vulnerabilities in Cisco IOS and IOS XE Software

1 April 2024

Cisco has released updates addressing multiple high severity vulnerabilities (CVE-2024-20311, CVE-2024-20314, CVE-2024-20307, CVE-2024-20308, CVE-2024-20259, CVE-2024-20303) affecting their IOS and IOS XE Software.

The vulnerabilities are:

  • CVE-2024-20311: Successful exploitation of this vulnerability may allow an attacker to send a crafted Locator ID Separation Protocol (LISP) packet to conduct denial-of-service (DoS) attack by causing the affected device to reload

  • CVE-2024-20314: Successful exploitation of this vulnerability may allow an attacker to send certain IPv4 packets to conduct DoS attack by causing high CPU utilisation and stop processing traffic

  • CVE-2024-20307 & CVE-2024-20308: Successful exploitation of these vulnerabilities may allow an unauthenticated attacker to conduct DoS attack by underflowing and overflowing the heap respectively

  • CVE-2024-20259: Successful exploitation of this vulnerability may allow an attacker to send a crafted DHCP request to conduct DoS attack by causing the affected device to reload

  • CVE-2024-20303: Successful exploitation of this vulnerability may allow an unauthenticated attacker to transmit specially crafted packets continuously to overwhelm the CPU, causing DoS attack due to the loss of connection by access points (APs)

The vulnerabilities affect the following products:

  • CVE-2024-20311: Cisco IOS or IOS XE Software enabled with LISP feature and configured with ingress/egress tunnel router, map server, and/or map resolver

  • CVE-2024-20314: Cisco IOS XE Software configured as SD-Access fabric edge nodes

  • CVE-2024-20307 & CVE-2024-20308: Cisco IOS or IOS XE Software enabled with Internet Key Exchange version 1 (IKEv1) fragmentation and configured with IKEv1-based VPN

  • CVE-2024-20259:

    • Catalyst 9000 Series Switches

    • DNA Traffic Telemetry Appliance

  • CVE-2024-20303: 

    • Catalyst 9800-CL Wireless Controllers for Cloud

    • Catalyst 9800 Embedded Wireless Controller for Catalyst 9300, 9400, and 9500 Series Switches

    • Catalyst 9800 Series Wireless Controllers

    • Embedded Wireless Controller on Catalyst APs

Users and administrators of the affected products are advised to update to the latest versions immediately.

More information is available here:

https://securityaffairs.com/161181/security/cisco-ios-and-ios-xe-software-flaws.html

https://sec.cloudapps.cisco.com/security/center/publicationListing.x